Billy Dodson wrote:
Anyone have any documents they are willing to share on the scope of work
for a pen-test? I have looked online but was unable to find any available
documentation.
The first thing is to understand the term. What's the difference
between pen-test, red-team test, vulnerability assessment,
security audit, etc. You will find these terms confused to a very
great degree -- so great that I'm not even certain that you use the
term in the same way as I do.
> If anyone could provide me with a some links or
> documentation outlining a pen-test/network audit it would be greatly
> appreciated.
So is it a pen-test you want to do or a network audit? They are
different. I will assume pen-test.
RFC2828 suggests that a pen-test is "a system test, often part of
system certification, in which evaluators attempt to circumvent the
security features of the system", but it doesn't seem to try to make a
distinction between various types of tests, so it can be difficult to
know just how far you can or should press this particular definition.
The book "Hack I.T." by Klevinsky, Laliberte and Gupta (Addison-Wesley,
2002) is the best place I know to start. It does not give the latest
hacks, but it will give you a good overview of the job, both as to
contents, and as to administration.
For some of the tricks of the trade, try the "Hacking Exposed" series
of books (Osborne/McGraw-Hill) except perhaps the J2EE & Java volume.
Chris McNab's 'Network Security Assessment' (O'Reilly, 2004) is also useful.
There are some books to avoid, I think ... but that may be
something for a different thresad.
I don't know of any good online material. The OSSTMM is not a pen-test
method, though you may be able to get useful ideas from it once
you know what you are looking for.
And once you know what you mean by the term, you have to ensure that
you understand what the customer is asking for.
--
Anders Thulin anders.thulin@tietoenator.com 040-661 50 63
TietoEnator Telecom & Media AB, Box 85, SE-201 20 Malmö
------------------------------------------------------------------------------
Internet Security Systems. - Keeping You Ahead of the Threat
When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security technology.
http://www.securityfocus.com/sponsor/ISS_pen-test_041001
-------------------------------------------------------------------------------
